slashvibe-mcp 0.8.6 → 0.8.7

package/auth-store.js

@@ -26,6 +26,10 @@ let _hydrated = false;
 // unlocking a tool on the strength of a filename is how a green dot comes to mean
 // nothing (issues #107, #110).
 let _verified = false;
+// We held a credential and could not tell whose it was. Distinct from "no credential":
+// signed out is an honest state, but a rejected token means the name on disk is not
+// backed by anything, and nothing may present it as the current identity (#107/#110).
+let _rejected = false;
 
 /**
  * Hydrate auth state from disk (call once at MCP startup)
@@ -83,6 +87,7 @@ function hydrate() {
       // A token we cannot attribute is one we must not act under.
       console.error('[auth-store] Token carries no identity — treating as signed out');
       _token = null;
+      _rejected = true;
     } else if (_token && stored && stored !== _handle) {
       console.error(
         `[auth-store] Stored handle @${stored} does not own this session — acting as @${_handle}`
@@ -112,12 +117,13 @@ function setToken(token, { verified = false } = {}) {
       // Same rule hydrate() applies, applied here too — a credential we cannot
       // attribute must not become the session.
       console.error('[auth-store] Refusing a token with no identity');
-      _token = null; _handle = null; _verified = false;
+      _token = null; _handle = null; _verified = false; _rejected = true;
       return;
     }
   }
 
   const hadToken = !!_token;
+  _rejected = false;
   _token = token;
   _verified = !!token && verified;
 
@@ -152,6 +158,25 @@ function getToken() {
  * @param {string} handle - User handle (without @)
  */
 function setHandle(handle) {
+  // A handle may be REMEMBERED, never asserted over a credential.
+  //
+  // `vibe_init` called this immediately after setToken(), passing the callback's separate
+  // `handle` field — so the identity derived from the token was overwritten by a value
+  // that merely travelled alongside it. When they agree nothing happens; when they
+  // disagree the client acts as one principal and displays another, which is issue #107
+  // recreated at the exact moment a new person signs in.
+  //
+  // tests/identity-binding.test.js did not catch it: it asserts setToken() AFTER
+  // setHandle(), where the token re-anchors. The real order is the reverse.
+  if (_token) {
+    const owner = handleFromToken(_token);
+    if (owner && handle && handle !== owner) {
+      console.error(
+        `[auth-store] Ignoring handle @${handle} — this credential belongs to @${owner}`
+      );
+      return;
+    }
+  }
   _handle = handle;
 }
 
@@ -163,6 +188,52 @@ function getHandle() {
   return _handle;
 }
 
+/**
+ * Did we hold a credential we could not attribute?
+ *
+ * "Signed out" and "signed in as nobody" look identical from `getHandle()` — both null.
+ * They are not the same fact, and callers that fall back to a remembered name need to
+ * tell them apart: with no credential the name on disk is the best we have, but with a
+ * REJECTED one it is a name nothing supports (#110).
+ *
+ * @returns {boolean}
+ */
+function hasRejectedCredential() {
+  return _rejected;
+}
+
+/**
+ * Is a stored credential actually usable right now?
+ *
+ * "A token exists" and "you are signed in" are different facts, and conflating them is
+ * how `npx slashvibe-mcp` came to answer "/vibe is configured" on a machine holding a
+ * credential that had expired 23 days earlier — then advise restarting the coding agent,
+ * which cannot help. The file existed, so the check passed.
+ *
+ * Local and cheap: decodes `exp` rather than asking the server, because this runs on the
+ * recovery path where the network may be the thing that is wrong. It cannot prove a token
+ * is GOOD — only the server can — but it reliably catches the case that actually stranded
+ * someone, which is a credential that is definitively over.
+ *
+ * @returns {{ ok: boolean, reason: 'none'|'unattributable'|'expired'|'usable', handle: string|null, expiresAt: number|null }}
+ */
+function inspectToken(token) {
+  if (!token) return { ok: false, reason: 'none', handle: null, expiresAt: null };
+  const who = handleFromToken(token);
+  if (!who) return { ok: false, reason: 'unattributable', handle: null, expiresAt: null };
+  let exp = null;
+  try {
+    const part = String(token).split('.')[1];
+    exp = JSON.parse(Buffer.from(part, 'base64url').toString('utf8')).exp ?? null;
+  } catch { exp = null; }
+  // No exp claim is not a failure — legacy tokens carry none, and refusing them here
+  // would sign people out to fix a display bug.
+  if (exp && exp * 1000 <= Date.now()) {
+    return { ok: false, reason: 'expired', handle: who, expiresAt: exp * 1000 };
+  }
+  return { ok: true, reason: 'usable', handle: who, expiresAt: exp ? exp * 1000 : null };
+}
+
 /**
  * Set one-liner (what user is building)
  * @param {string} oneLiner - One-liner description
@@ -210,6 +281,16 @@ function clear() {
   _handle = null;
   _oneLiner = null;
   _verified = false;
+  _rejected = false;
+  // Clearing must also forget that we ever loaded, or `hydrate()` returns early forever
+  // and the store stays empty while disk holds a perfectly good credential. Everything
+  // that reads identity then falls through to the file — which is issue #107 reappearing
+  // by a different route, and silently, since the file usually names the right person.
+  //
+  // NOTE for whoever wires logout to this: clearing memory is not signing out. Disk is
+  // re-read on the next question, so a logout must also remove the credential from
+  // config.json — otherwise the session comes straight back.
+  _hydrated = false;
   console.error('[auth-store] Cleared');
 }
 
@@ -233,6 +314,8 @@ module.exports = {
   getToken,
   setHandle,
   getHandle,
+  hasRejectedCredential,
+  inspectToken,
   setOneLiner,
   getOneLiner,
   isAuthenticated,

package/cli.js

@@ -19,12 +19,38 @@ if (args.includes('setup')) {
 } else if (process.stdin.isTTY) {
   // Running from terminal (not as MCP server)
   const config = require('./config');
-  if (!config.isInitialized() && !config.getAuthToken()) {
-    // Not authenticated — auto-trigger setup
+  const authStore = require('./auth-store');
+
+  // A TOKEN EXISTING IS NOT BEING SIGNED IN.
+  //
+  // This used to pass on `config.getAuthToken()` being truthy, which is true of a
+  // credential that expired months ago. On a Mac Studio holding a token 23 days dead it
+  // printed "/vibe is configured" and suggested restarting the coding agent — advice that
+  // cannot help, given to someone whose only real problem was that they were signed out.
+  // The recovery path told them there was nothing to recover.
+  const cred = authStore.inspectToken(config.getAuthToken());
+
+  if (!config.isInitialized() && !cred.ok) {
+    // Never signed in — set up.
+    require('./setup.js');
+  } else if (!cred.ok && cred.reason !== 'none') {
+    // Signed in once, not any more. Say which, and fix it rather than describing it.
+    const when = cred.expiresAt
+      ? ` (it expired ${Math.max(1, Math.round((Date.now() - cred.expiresAt) / 86400000))} days ago)`
+      : '';
+    console.log(cred.handle
+      ? `Your /vibe sign-in for @${cred.handle} is no longer valid${when}.`
+      : `Your /vibe sign-in is no longer valid${when}.`);
+    console.log('Signing you back in...');
+    console.log('');
     require('./setup.js');
   } else {
-    // Already set up — show status
-    console.log('/vibe is configured. Restart your coding agent (Claude Code / Codex / Cursor) to connect.');
+    // Genuinely signed in — say WHO, because a status line that cannot name you is the
+    // one that hid this in the first place.
+    console.log(cred.handle
+      ? `/vibe is configured — signed in as @${cred.handle}.`
+      : '/vibe is configured.');
+    console.log('Restart your coding agent (Claude Code / Codex / Cursor) to connect.');
     console.log('');
     console.log('Commands:');
     console.log('  npx slashvibe-mcp setup   — re-run setup wizard');

package/config.js

@@ -116,10 +116,25 @@ function getHandle() {
   //
   // Required lazily: auth-store loads config during hydration, and a top-level import
   // here would close that circle.
+  //
+  // We hydrate here rather than assuming someone already did. The store answers from
+  // memory, so before hydration it answers null — and this function would quietly fall
+  // through to the file, which is the exact bug above. That made the fix depend on an
+  // ordering nothing enforced: correct inside the MCP server (which hydrates in its
+  // constructor) and wrong in any script, CLI path or test that reads identity first.
+  // A guarantee that holds only when called in the right order is not a guarantee.
+  // hydrate() is idempotent and reads two files it has usually already read.
   try {
     const authStore = require('./auth-store');
+    authStore.hydrate();
     const fromCredential = authStore.getHandle();
     if (fromCredential) return fromCredential;
+
+    // A credential was present and could not be attributed. The remembered name below
+    // must NOT step in: it would put a handle on screen that nothing backs, which is
+    // this bug wearing the file's clothes. No credential at all is a different and
+    // honest state, and falls through.
+    if (authStore.hasRejectedCredential()) return null;
   } catch (e) {
     // auth-store unavailable (early boot) — fall through to what is on disk.
   }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "mcpName": "io.github.vibecodinginc/vibe",
-  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) \u2014 the /vibe kernel",
+  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
   "main": "index.js",
   "bin": {
     "slashvibe-mcp": "./cli.js",

package/setup.js

@@ -274,8 +274,23 @@ async function testConnection() {
   // HTTP already answers; the body is only allowed to veto by reporting an explicit
   // unhealthy state.
   // Bounded: a hung connection must not leave a new user staring at a spinner with no
-  // way to know whether to wait. And "degraded" is not good enough to promise the next
-  // step will work — the very next thing setup does is an OAuth round trip.
+  // way to know whether to wait.
+  //
+  // "DEGRADED" IS NOT UNREACHABLE, and treating it as such blocked every new install on
+  // 2026-08-01. Upstash hit a quota wall, /api/health honestly reported `degraded`
+  // because a CACHE was down, and this returned false — so setup told people "Could not
+  // reach slashvibe.dev" and advised them to check their internet connection, about a
+  // site that was serving perfectly.
+  //
+  // The reasoning in the version that did this was mine and it was wrong: I blocked on
+  // degraded because "the next step is an OAuth round trip". OAuth does not touch the
+  // cache. A partial-capability signal about a subsystem we do not need is not a reason
+  // to refuse someone the product, and "we cannot reach the server" is not a true thing
+  // to say when we just did.
+  //
+  // Only an explicitly unhealthy service blocks. Everything else proceeds, because the
+  // OAuth round trip that follows is a better test of what setup actually needs than any
+  // status string.
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), 8000);
   try {
@@ -283,7 +298,7 @@ async function testConnection() {
     if (!response.ok) return false;
     const data = await response.json().catch(() => ({}));
     if (data.success === false) return false;
-    if (typeof data.status === 'string' && /unhealthy|degraded|down|error/i.test(data.status)) return false;
+    if (typeof data.status === 'string' && /\bunhealthy\b|\bdown\b/i.test(data.status)) return false;
     return true;
   } catch (e) {
     return false;

package/store/api.js

@@ -355,6 +355,28 @@ async function getActiveUsers() {
     const liveAgents = (result.agents || []).filter(a => a.isLive && a.broadcastRoom);
     const users = [...(result.active || []), ...(result.away || []), ...liveAgents];
 
+    // SIGNED OUT IS NOT AN EMPTY ROOM.
+    //
+    // When the caller has no valid credential the server answers `anonymous: true` with
+    // empty lists and PUBLIC COUNTS — "2 people are here, sign in to see who". This
+    // function used to return only the mapped array, so every caller saw `[]` and could
+    // not tell the two apart. `vibe_who` rendered it as "Quiet right now — you're the
+    // only one here", which is the most damaging sentence this product can say: the
+    // entire promise is that other people are there, and a signed-out user was told the
+    // room was dead. Observed on the Mac Studio 2026-08-01 with a token that had expired
+    // 23 days earlier, while four people were actually online.
+    //
+    // Attached to the array rather than changing the return type because sixteen call
+    // sites read this as a list. Callers that do not care are unaffected; callers that
+    // render a claim about the room now have what they need to be honest.
+    // Two shapes mean the same thing. v1 answers 200 with `anonymous: true` and public
+    // COUNTS; v2 answers a hard 401 and no counts at all. Both are "we cannot see who is
+    // here", and neither is "nobody is here" — so both must reach the caller as the same
+    // fact, with counts present only when the server actually supplied them. Claiming
+    // "0 people are here" because we lack a number would swap one false statement for
+    // another.
+    const unauthenticated = result?.anonymous === true || result?.statusCode === 401;
+
     // Map to normalized format (v2 uses 'handle', v1 uses 'username')
     const mappedUsers = users.map(u => ({
       handle: u.handle || u.username,
@@ -400,6 +422,14 @@ async function getActiveUsers() {
       // Non-fatal: profiles module may not be available in some contexts
     }
 
+    // On the RETURNED array, not the intermediate `users` — they are different objects
+    // and attaching to the wrong one is a silent no-op that reads as "the signal is not
+    // there" rather than as a bug.
+    Object.defineProperties(mappedUsers, {
+      anonymous: { value: unauthenticated, enumerable: false },
+      counts: { value: result?.counts || null, enumerable: false },
+    });
+
     return mappedUsers;
   } catch (e) {
     console.error('Who failed:', e.message);

package/tools/start.js

@@ -291,23 +291,15 @@ async function handler(args) {
     }
   } catch (e) {}
 
-  // Step 4: Get connection suggestions from API
-  let suggestions = [];
-  try {
-    const apiUrl = config.getApiUrl();
-    const suggestionsResponse = await fetch(`${apiUrl}/api/suggestions?user=${myHandle}&limit=3`, {
-      headers: { 'User-Agent': 'vibe-mcp-client' }
-    });
-
-    if (suggestionsResponse.ok) {
-      const data = await suggestionsResponse.json();
-      if (data.success && data.suggestions) {
-        suggestions = data.suggestions;
-      }
-    }
-  } catch (e) {
-    // Silent fail - suggestions are nice-to-have
-  }
+  // Step 4 used to fetch /api/suggestions and render "Suggested connections" — three
+  // strangers proposed on every session start, in the DEFAULT surface rather than behind
+  // VIBE_EXTRAS. Removed 2026-08-01 (Seth) with the automated cold intros in
+  // api/lib/board-service.js.
+  //
+  // Proposing people you do not know is the retired public-network product. A private
+  // fabric shows you the people you already work with, and says nothing when there is
+  // nobody to say anything about. NOTE: `workContext.suggestions` elsewhere in this file
+  // is unrelated — that is local work context, not people.
 
   // Generate the ASCII welcome card (matches init.js format)
   const welcomeCard = generateWelcomeCard({
@@ -380,17 +372,6 @@ async function handler(args) {
     display += `\n_Session sharing active. Use vibe_guest to exchange messages._`;
   }
 
-  // Add connection suggestions (if any)
-  if (suggestions.length > 0) {
-    display += `\n\n**🤝 Suggested connections:**`;
-    suggestions.slice(0, 3).forEach(s => {
-      display += `\n• @${s.handle} — ${s.reason}`;
-      if (s.github_name) {
-        display += ` (${s.github_name})`;
-      }
-    });
-  }
-
   // Add memory context for returning users
   if (threads.length > 0) {
     const recentThreads = threads.slice(0, 3);
@@ -454,16 +435,6 @@ async function handler(args) {
     };
   }
 
-  // Include connection suggestions for smart discovery
-  if (suggestions.length > 0) {
-    response.suggestions = suggestions.map(s => ({
-      handle: s.handle,
-      reason: s.reason,
-      githubName: s.github_name || null,
-      lastActive: s.last_active || null,
-      matchScore: s.score || null
-    }));
-  }
 
   // Determine session state and suggest appropriate flow
   let suggestion = null;

package/tools/who.js

@@ -178,6 +178,30 @@ async function handler(args) {
   // Check for notifications (presence + messages)
   notify.checkAll(store);
 
+  // TWO EMPTY STATES, AND THEY ARE NOT THE SAME FACT.
+  //
+  // An empty list can mean "nobody is here" or "we cannot see" — and only one of those
+  // is about the room. A signed-out session used to get the first message while four
+  // people were online, which tells someone the product is dead at the exact moment they
+  // are deciding whether it works.
+  if (rawUsers.anonymous) {
+    // Say the number only when the server gave us one. v1 supplies public counts; v2
+    // answers 401 with nothing, and inventing "0 people" there would be the same lie in
+    // a different costume.
+    const n = rawUsers.counts?.active;
+    const line = typeof n === 'number'
+      ? `_You're signed out — ${n === 1 ? '1 person is' : `${n} people are`} here right now, but names need a sign-in._`
+      : `_You're signed out, so I can't see who's here._`;
+    return {
+      structured: { generatedAt: Date.now(), users: [], signedOut: true, counts: rawUsers.counts || null },
+      display: `## Who's Around
+
+${line}
+
+Run \`vibe init\` and you'll see who, and they'll see you.`
+    };
+  }
+
   if (users.length === 0) {
     return {
       structured: { generatedAt: Date.now(), users: [] },

package/version.json

@@ -1,12 +1,12 @@
 {
-  "version": "0.8.6",
-  "updated": "2026-07-31",
-  "changelog": "Who is here is no longer public. Counts are; handles are not \u2014 sign in to see names, which every normal install already does. The rest is the first ninety minutes: an empty inbox now says what to do next instead of 'all caught up' to someone who never had a message, the board stops advertising tools your session does not have, and a failed message names one fix instead of three contradictory ones.",
+  "version": "0.8.7",
+  "updated": "2026-08-01",
+  "changelog": "Three ways /vibe told you something untrue, all on the path a new person walks. Installing failed with \"Could not reach slashvibe.dev\" whenever a cache was over quota — the site was serving fine, and a subsystem setup never uses was refusing you the product. Re-running setup on a machine whose login had expired answered \"/vibe is configured\" and quit, so the one command for fixing it said there was nothing to fix. And asking who was around while signed out reported an empty room instead of saying you were signed out, which is the worst thing this product can get wrong. Logins are now 30 days everywhere; new accounts had been getting one-hour ones.",
   "features": [
-    "Presence names require a credential; counts stay public",
-    "Empty inbox tells you what to do next, and knows arriving from caught-up",
-    "The board only suggests commands your session actually has",
-    "Errors name one fix and stop"
+    "A degraded cache no longer blocks installing",
+    "An expired login says so, names the account, and signs you back in",
+    "Signed out reads as signed out, not as an empty room",
+    "One login lifetime — 30 days, including for brand-new accounts"
   ],
   "deprecated": [],
   "breaking": false,